1

The contact form on a site I am currently developing was displaying an error when trying to submit and says the form has expired.

Based on feedback I found in various forums, the workaround I have found was to turn off CSRF protection through the config file using this code:

$config['disable_csrf_protection'] = 'y';

This fixes the form, but creates another bug that prevents users from being able to log out, causing this error: You are not authorized to perform this action.

Does anyone have a solution that will fix both problems?

Improve this question
4
  • You just should disable the csrf protection in very specific situations, like a server based cache. These forms being rejected are on CP or on front end?
    – Sobral
    Commented Oct 25, 2014 at 14:16
  • The form that is giving me the error is a contact form on the front end. I remember setting a CSRF setting in the database in the past, but I cannot find where this was.
    – Amanda
    Commented Oct 25, 2014 at 22:53
  • Is the date and time of the server set right? Does the {current_time} give you the right time?
    – Sobral
    Commented Oct 25, 2014 at 23:25
  • The data is correct, and the time is showing up as Eastern time zone (I am in Mountain time zone.)
    – Amanda
    Commented Oct 26, 2014 at 14:39

1 Answer 1

Reset to default
0

I found an answer that seems to be working. Here are the details in case anyone else is having a similar issue.

I kept the code in the config.php file that turns off CSRF protection:

$config['disable_csrf_protection'] = 'y';

Then to fix the issue with logout failing, I implemented an edit suggested by Robin Sowell on the Ellis Lab forum. The edit is in the file "system/expressionengine/modules/member/mod.member_auth.php":

Find this code in that file:

if ($token != CSRF_TOKEN)
{

and change to:

if ( ! bool_config_item('disable_csrf_protection') && $token != CSRF_TOKEN)
{
Improve this answer
1
  • Just circling back for any new readers- the inability to logout with csrf disabled was indeed a bug fixed in 2.8.2. But Robson's right- csrf should only be disabled for testing and shouldn't be a long term solution to a secure form problem.
    – Robin Sowell
    Commented May 27, 2015 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.